Fix npm audit issue

[johannespfeiffer]

Currently, there is an issue with npm audit and object-path@0.11.4. I know that you removed it in version 3.0.0 of this library, but as popular apps like https://github.com/facebook/create-react-app use it in version 2.0.0 you might want to consider this PR (applied to 2.0.0 as 2.0.1) and publish a patch of 2.0.1 on npm.

See facebook/create-react-app#9842 for a related discussion.

[bholloway]

Unless I'm mistaken create-react-app has no direct dependency here and it only has a pinned dependency on resolve-url-loader@3.1.1.

Can it use resolve-url-loader@3.1.2?

[leifjones]

FWIW, I'm seeing the following in the package-lock.json of a project that is presenting the audit issue with object-path.

Note that object-path is included in adjust-sourcemap-loader's requires.

    "adjust-sourcemap-loader": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/adjust-sourcemap-loader/-/adjust-sourcemap-loader-2.0.0.tgz",
      "integrity": "sha512-4hFsTsn58+YjrU9qKzML2JSSDqKvN8mUGQ0nNIrfPi8hmIONT4L3uUaT6MKdMsZ9AjsU6D2xDkZxCkbQPxChrA==",
      "dev": true,
      "requires": {
        "assert": "1.4.1",
        "camelcase": "5.0.0",
        "loader-utils": "1.2.3",
        "object-path": "0.11.4",
        "regex-parser": "2.2.10"
      },
      "dependencies": {
        "camelcase": {
          "version": "5.0.0",
          "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.0.0.tgz",
          "integrity": "sha512-faqwZqnWxbxn+F1d399ygeamQNy3lPp/H9H6rNrqYh4FSVCtcY+3cub1MxA8o9mDd55mM8Aghuu/kuyYA6VTsA==",
          "dev": true
        },
        "emojis-list": {
          "version": "2.1.0",
          "resolved": "https://registry.npmjs.org/emojis-list/-/emojis-list-2.1.0.tgz",
          "integrity": "sha1-TapNnbAPmBmIDHn6RXrlsJof04k=",
          "dev": true
        },
        "json5": {
          "version": "1.0.1",
          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
          "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
          "dev": true,
          "requires": {
            "minimist": "^1.2.0"
          }
        },
        "loader-utils": {
          "version": "1.2.3",
          "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz",
          "integrity": "sha512-fkpz8ejdnEMG3s37wGL07iSBDg99O9D5yflE9RGNH3hRdx9SOwYfnGYdZOUIZitN8E+E2vkq3MUMYMvPYl5ZZA==",
          "dev": true,
          "requires": {
            "big.js": "^5.2.2",
            "emojis-list": "^2.0.0",
            "json5": "^1.0.1"
          }
        }
      }
    }

[johannespfeiffer]

The reasoning was to fix these issues as high as possible in the dependency trail with patch versions.
Regarding CRA this PR is obsolete now as facebook/create-react-app#9841 got merged.
Thanks.

[bholloway]

this PR is obsolete now

okay closing 👍